1
Choose a direction
Escape makes markup safe to display as text. Unescape restores named or decimal entities to their original characters.
DEVELOP.06 HTML ESCAPE
HTML Escape / Unescape
Convert between source markup and HTML entities in real time, with essential options in one toolbar and a click-to-insert entity reference below.
RAW
Input
ENTITY
Converted result
§ 01
How to escape or restore HTML
2
Enter content
Paste text or import an HTML, XML, SVG, or TXT file. Live conversion is enabled by default.
3
Copy or download
Copy the result or download it as a text file. Processing never leaves the current browser.
§ 02
Why HTML entities exist
Browsers read angle brackets as tags and ampersands as entities. To show a markup tag literally in an article, documentation page, or code sample, it must be encoded or the browser may interpret it as page structure.
Escaping is also part of safely displaying user-generated content, but rules differ by context. This tool focuses on entities used in HTML text and common attributes; it is not a substitute for complete validation and XSS protection.
§ 03
HTML entity reference & quick insert
Search and click any row to insert its character into the input above. The SEO reference table doubles as an input shortcut.
Character
Named
Numeric
Meaning
No matching entities
§ 04
Frequently Asked Questions
Q1Is HTML escaping the same as URL encoding?
No. HTML escaping replaces markup-significant characters with entities. URL encoding replaces reserved URL characters with percent-encoded bytes.
Q2When do quotation marks need escaping?
Inside an HTML attribute, the quote matching the attribute delimiter must be escaped. Essential mode handles both kinds of quotes so the result is safer to paste across common contexts.
Q3What is the difference between named and numeric entities?
A named entity is generally easier to read, while a numeric entity directly references a Unicode code point. Browsers render the same character; numeric entities cover characters without a common name.
Q4Does this tool prevent every XSS attack?
No. Output encoding must match its precise HTML, attribute, URL, or JavaScript context and should be combined with trusted templates and a content security policy.
Q5Is my code saved?
No. The page does not call a server or use local storage for input or history.